Burp Suite DAST Critical Vulnerability CVE-2026-90481 Patch Advisory

DAST 2026.8 Vulnerability Remediation Summary Vulnerability Overview CVE ID: CVE-2026-90481 Vulnerability Type: Critical Security Issue Remediation Version: DAST 2026.8 (Released on August 5, 2026) Scope of Impact Affects Burp Suite DAST software Classified as critical; upgrade is strongly recommended by the vendor Remediation Plan Upgrade to DAST 2026.8 Download method: Windows installer (x64) Other Bug Fixes Fixed an issue where certain Java regex constructs (including for case-insensitive matching) were not accepted in scope rules. Fixed issues where Postman, SOAP, and GraphQL API definitions containing unsupported operations could fail or report errors. Fixed an issue where custom headers were not consistently applied during the audit process. Fixed an issue where the scanner did not always send the correct headers. Fixed an issue where scanning and active auditing could consume excessive CPU resources on large sites. Fixed an issue where the recorded-login editor might accept a TOTP key and generate seemingly valid codes. Fixed an issue where TOTP keys were accepted as valid even when the scanner rejected them as invalid. Fixed an issue in self-hosted deployments where old Burp and JRE files accumulated in the server download directory, consuming excessive disk space. Other Updates Java Updates: Java Runtime updated to 21.0.12; Azul Zulu updated to 21.52.15. New Features: - Full lifecycle tracking for vulnerabilities (persistent issue records). - Direct management of issues from the Issues list. - Inline recorded-login functionality in CI/CD scans. - Added Integrations section to the Connectivity settings page. > Note: This page does not include POC code or exploit code.

Goal Reached Thanks to every supporter — we hit 100%!

Burp Suite DAST Critical Vulnerability CVE-2026-90481 Patch Advisory